What it means
A language model may encounter instructions embedded in content it was asked to analyze: a webpage, email, document, or tool result. Prompt injection tries to make that content influence the model as though it were an authorized instruction. Direct attacks arrive in a user’s input; indirect attacks arrive through outside material. The most serious consequences arise when the application gives the model access to secrets or powerful tools. Telling the model to ignore malicious instructions is useful context, but it is not a dependable authorization boundary.
AN ILLUSTRATIVE SCENARIO
A support ticket asks for a firewall change
A security team uses an assistant to summarize support tickets. One ticket contains a sentence claiming an administrator approved opening a firewall. The assistant should treat that sentence as a claim in evidence. The system’s tool service independently checks the authenticated requester, allowed action, resource scope, and required approval. A ticket’s words cannot grant those permissions. The summary can quote the suspicious request for an analyst while the change remains blocked by the application.
Put it to work
- Map every place untrusted text enters the model and every tool or sensitive dataset it can reach. Separate content to analyze from authenticated instructions and preserve its source.
- Enforce permissions outside the model: narrowly scoped tool identities, validated parameters, limited destinations, and independent approvals for consequential actions. Do not let retrieved text supply or override those decisions.
- Test hostile documents and tool responses using synthetic data. Check attempted tool calls and data access, not just whether the final answer sounds cautious, and keep a route for human escalation.
How to check your work
In a controlled test, provide a document that requests an unauthorized action. Confirm the tool service rejects that action even if the model asks for it, and that neither the answer nor an outbound request exposes protected test data.
Connect the ideas
- Trust boundary
A place where identity, network, or data assumptions change and a fresh check is required.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- Least privilege
Granting each identity only the actions, objects, and time window required for the current job.